Anyone who collects and uses other people’s data must meet legal requirements such as prior consent from the data subject. Data controllers who can legally process other people’s data must comply with the corresponding rules. In this context, controllers also disclose and inform all matters related to the processing of such data subject. After the OECD adopted the privacy principle of transparent and fair processing, most countries have accepted it, including the EU and Korea. The data subject must know who, for what purpose, and how their data is processed in order to control their data. The data subject’s right to basic information on data processing is the prerequisite for exercising their rights to rectification, erasure, etc. However, this basic principle has been mitigated as Korea revised the Personal Information Protection Act in February 2020. The PIPA introduced an exceptional case of data processing, pseudonymization. When data controllers process pseudonymized personal data, they can process it without prior consent from the data subject and without notifying the data subject of relevant information related to the processing. Korea publicly announced it would revise the PIPA by referring to European Union’s General Data Protection Regulation. Still, GDPR does not eliminate the data controller’s obligation to notify when pseudonymized processing. Only consent is exempted if the data initially collected is pseudonymized for compatible purposes such as statistical, scientific research, or archiving purposes in the public interest. This inconsistency appears because the systems of both laws do not match perfectly even though they are much similar. This paper suggests how the PIPA guarantees the data subject’s right to basic information when processing by a comparative study between Korea’s PIPA and the EU’s GDPR. Notification of data processing is crucial in ensuring the right to informational self-determination that the PIPA should accomplish as the ultimate goal.
목차
Abstract Ⅰ. Introduction Ⅱ. Right to be informed of data processing 1. Legal implication 2. Right to be informed in the Personal Information Protection Act III. Suggestions for the Notification System in the PIPA referred to the GDPR 1. Notification when processing based on legitimate bases other than consent 2. Notification of pseudonymized data processing Ⅳ. Conclusion [References]
키워드
Personal Information Protection Act(Korea)General Data Protection Act(European Union)Principle of Transparency and FairnessNotification ObligationExemption from NotificationRight to be informedRight to informational self-determinationPseudonymizationCompatibility of Purposes for processing
저자
Kim, Hyun Sook [ Senior Director of Ministry of the Interior and Safety, Adjunct Professor / Ph.D. Dongguk University ]
동국대학교 비교법문화연구원 [The Institute of Comparative Law and Legal Culture]
설립연도
2000
분야
사회과학>법학
소개
본 연구소에서는 세계 각국의 새로운 법률제도를 그때그때 입수하여 이를 소개하고 한국 실정에 접목가능성을 연구·분석한다. 아울러 본 연구소는 국내의 각종 학술단체, 연구소, 연구기관과의 교류를 증진함은 물론 외국대학의 연구소와 공동연구를 통해 외국의 법문화와 학풍을 소개함으로써 대외적인 학풍선양에도 기여하게 함을 목적으로 한다.